Red Hat Security Advisory

RHSA-2024:3426

varnish:6 security update

Released 2024-05-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.6) varnish-6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6, varnish-6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6, varnish-6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6 +15

Fixes 1 record

TI-2024-19907 CVE-2024-30156 · GHSA-c3wj-m54r-wfgq

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish…

MEDIUM 45

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03663 Published 2024-03-24 Fixed CWE-770